Method for role-based data transmission using physically unclonable function (PUF)-based keys

Abstract

A method includes encrypting a first message that contains a first public key of a first peer, by using a second public key of a second peer, and decrypting a second message sent from the second peer by using a first private key paired with the first public key. The second message is encrypted at the second peer by using the first public key, and contains an encrypted data encrypted by using the second public key and hashed by using a secret key of the first peer.

What is claimed is: 
     
       1. A method, comprising:
 encrypting a first message that contains a first public key of a first peer, by using a second public key of a second peer; 
 decrypting a second message sent from the second peer by using a first private key paired with the first public key, the second message comprising a write command and being encrypted at the second peer by using the first public key, and containing an encrypted data encrypted by using the second public key and hashed by using a secret key of the first peer; 
 hashing the encrypted data by using the secret key to obtain a hash value; 
 comparing the hash value against a hash value associated with the hashed encrypted data; 
 determining that the hash values are equal; and 
 storing the encrypted data at the first peer in accordance with the write command, 
 wherein the first public key, the second public key, the first private key and the secret key are physically unclonable function (PUF)-based keys. 
 
     
     
       2. The method according to  claim 1 , before decrypting, further comprising:
 encrypting a message that contains the secret key, by using the second public key; and 
 sending the message that contains the secret key to the second peer. 
 
     
     
       3. The method according to  claim 1 , after storing, further comprising:
 receiving a third message that obtains a read command from the second peer, the third message encrypted by using the first public key; and 
 decrypting the third message by using the first private key. 
 
     
     
       4. The method according to  claim 3  further comprising:
 retrieving the encrypted data in accordance with the read command; 
 hashing the encrypted data by using the secret key; and 
 encrypting the hashed encrypted data by using the second public key. 
 
     
     
       5. The method according to  claim 1 , before encrypting the first message, further comprising:
 preprogramming the second public key in a storage of the first peer. 
 
     
     
       6. A method, comprising:
 decrypting a message sent from a first peer that contains a first public key of the first peer, by using a second private key of a second peer; 
 decrypting a message sent from the first peer that contains a first secret key of the first peer, by using the second private key; 
 encrypting a data by using a second public key of a second peer, the second public key paired with the second private key; 
 hashing the encrypted data by using the first secret key; and 
 encrypting a first message that contains the hashed encrypted data and a first command requesting the first peer to write the encrypted data, by using the first public key, 
 wherein the first public key, the first secret key, the second public key and the second private key are physically unclonable function (PUF)-based keys. 
 
     
     
       7. The method according to  claim 6 , after encrypting the first message, further comprising:
 encrypting, by using the first public key, a second message that contains a second command requesting the first peer to send the encrypted data; and 
 sending the second message to the first peer. 
 
     
     
       8. The method according to  claim 7  further comprising:
 receiving a third message that contains the encrypted data in response to the second message, the encrypted data being hashed by using the secret key and then encrypted at the first peer by using the second public key. 
 
     
     
       9. The method according to  claim 8  further comprising:
 decrypting, by using the second private key, the third message sent from the first peer. 
 
     
     
       10. The method according to  claim 9  further comprising:
 hashing the encrypted data by using the secret key to obtain a hash value; and 
 comparing the hash value against a hash value associated with the hashed encrypted data. 
 
     
     
       11. The method according to  claim 6 , before decrypting a message sent from the first peer that contains the first public key, further comprising:
 preprogramming the second public key in a storage of the first peer. 
 
     
     
       12. The method according to  claim 6  further comprising:
 selecting from a lookup table a first challenge associated with a first peer; and 
 encrypting a first message that contains the first challenge by using a first public key of the first peer. 
 
     
     
       13. The method according to  claim 12  further comprising:
 receiving a second message sent from the first peer, the second message encrypted by using a second public key of a second peer and containing a first response corresponding to the first challenge; and 
 decrypting the second message by using a second private key paired with the second public key. 
 
     
     
       14. The method according to  claim 13  further comprising:
 comparing the first response against a response corresponding to the first challenge in the lookup table. 
 
     
     
       15. A device, comprising:
 a physically unclonable function (PUF) module comprising a PUF physical and configured to provide a random number; 
 a key generator configured to generate a secret key and a pair of public key and private key of the device in response to the random number; 
 an encrypt module configured to encrypt a first message by using a public key of a recipient; 
 a decrypt module configured to, in response to a second message encrypted by the recipient using the public key of the device, decrypt the second message by using the private key of the device, wherein the second message comprises data encrypted by the recipient using the public key of the recipient; and 
 a register file configured to store the encrypted data in response to the second message contains a command requesting the device to write the encrypted data. 
 
     
     
       16. The device according to  claim 15  further comprising:
 a storage to store a preprogrammed public key of a recipient. 
 
     
     
       17. The device according to  claim 16  further comprising:
 an arbitrator configured to determine if the recipient associated with the second message has a corresponding public key in the storage.